constraint-engine (制約)

Unified skill for constraint generation, pre-action checking, circuit breaker management,
and constraint lifecycle. Consolidates 7 granular skills into a single enforcement system.

Trigger: 行動前∨閾値到達 (pre-action or threshold reached)

Source skills: constraint-generator, circuit-breaker, emergency-override, constraint-lifecycle, constraint-versioning, positive-framer (partial), contextual-injection (partial)

Installation

CODEBLOCK0

Dependencies: leegitw/failure-memory (for eligibility data)

CODEBLOCK1

Standalone usage: Requires failure-memory for constraint generation from observations.
For full lifecycle management, install the complete suite (see Neon Agentic Suite).

Data handling: This skill operates within your agent's trust boundary. When triggered,
it uses your agent's configured model for constraint checking and generation. No external APIs
or third-party services are called. Results are written to output/constraints/ in your workspace.

What This Solves

Instructions get ignored. Rules get forgotten. Documentation goes unread. This skill takes a different approach — constraints generated from actual failures:

1. 1. Generate constraints from observations that meet the eligibility threshold (R≥3 ∧ C≥2)
2. Enforce constraints at runtime with a circuit breaker (CLOSED → OPEN → HALF-OPEN)
3. Manage lifecycle from proposal through adoption to retirement

The insight: A constraint born from "this actually broke" carries more weight than "this might break." Consequences teach better than instructions.

Usage

CODEBLOCK2

Sub-Commands

Command	CJK	Logic	Trigger
INLINECODE3	検査	action→constraints[]→pass∨block	Next Steps (auto)
INLINECODE4

生成 | eligible(obs)→constraint | Next Steps (auto) | | /ce status | 状態 | active[], circuit∈{CLOSED,OPEN,HALF} | Explicit | | /ce override | 上書 | constraint→bypass(temp), audit.log++ | Explicit | | /ce lifecycle | 周期 | state∈{draft→active→retiring→retired} | Explicit | | /ce version | 版本 | constraint→v++, history.preserve | Explicit | | /ce threshold | 閾値 | user∨context→custom_threshold | Explicit |

Arguments

/ce check

Argument	Required	Description
action	Yes	Action to check against constraints
--severity

No | Minimum severity to check: critical, important, minor (default: all) |

/ce generate

Argument	Required	Description
observation	Yes	Observation ID or pattern to generate constraint from
--force

No | Generate even if eligibility criteria not met |

/ce status

Argument	Required	Description
--circuit	No	Show circuit breaker status only
--active

No | Show active constraints only |

/ce override

Argument	Required	Description
constraint	Yes	Constraint ID to override
reason

Yes | Reason for override (logged for audit) | | --duration | No | Override duration (default: "session") |

/ce lifecycle

Argument	Required	Description
constraint	Yes	Constraint ID
state

Yes | Target state: draft, active, retiring, retired |

/ce version

Argument	Required	Description
constraint	Yes	Constraint ID
--bump

No | Version bump type: major, minor, patch (default: minor) |

/ce threshold

Argument	Required	Description
--R	No	Custom recurrence threshold (default: 3)
--C

No | Custom confirmation threshold (default: 2) | | --reset | No | Reset to default thresholds |

Configuration

Configuration is loaded from (in order of precedence):

1. 1. .openclaw/constraint-engine.yaml (OpenClaw standard)
2. INLINECODE21 (Claude Code compatibility)
3. Defaults (built-in)

CODEBLOCK3

Core Logic

Eligibility Criteria

Observation becomes eligible for constraint when:

CODEBLOCK4

Criterion	Meaning
R≥3	At least 3 recurrences
C≥2

At least 2 human confirmations |
| D/(C+D)<0.2 | False positive rate under 20% |
| sources≥2 | Observed by at least 2 different sources |

Positive Reframing

Constraints are automatically reframed positively:

Negative	Positive
"Don't commit without tests"	"Always run tests before commit"
"Don't push to main directly"

"Always create PR for main changes" |
| "Don't deploy without review" | "Always get code review before deployment" |
| "Don't skip migrations" | "Always run database migrations before release" |

Example: Code Review Constraint

CODEBLOCK5

Example: Deployment Gate Constraint

CODEBLOCK6

Circuit Breaker States

State	Meaning	Behavior
CLOSED	Normal operation	Constraints enforced
OPEN

Circuit tripped | Block all related actions | | HALF-OPEN | Testing recovery | Allow limited actions |

Circuit Breaker Thresholds

Severity	Threshold	Window
CRITICAL	3 violations	30 days
IMPORTANT

5 violations | 30 days | | MINOR | 10 violations | 30 days |

Constraint Lifecycle

CODEBLOCK7

Output

/ce check output (pass)

CODEBLOCK8

/ce check output (block)

CODEBLOCK9

/ce status output

CODEBLOCK10

/ce generate output

CODEBLOCK11

Integration

• - Layer: Core
• Depends on: failure-memory (for eligibility data)
• Used by: governance (for constraint reviews), safety-checks (for enforcement)

Failure Modes

Condition	Behavior
Invalid sub-command	List available sub-commands
Constraint not found

Error with suggestion to search | | Ineligible observation | Show missing criteria, suggest /fm status | | Circuit OPEN | Block action, show recovery guidance | | Override without reason | Require reason for audit trail |

Next Steps

After invoking this skill:

Condition	Action
Constraint generated	Add to output/constraints/draft/, notify user
Constraint activated

Move to output/constraints/active/ |
| Action blocked | Log to output/hooks/blocked.log, explain why |
| Circuit OPEN | Surface to user with recovery guidance |
| Override used | Audit log entry, temporary bypass only |

Workspace Files

This skill reads/writes:

CODEBLOCK12

Security Considerations

What this skill accesses:

• - Configuration files in .openclaw/constraint-engine.yaml and INLINECODE26
• Observation data from failure-memory (via .learnings/ directory)
• Its own output directories output/constraints/ and INLINECODE29

What this skill does NOT access:

• - Files outside declared workspace paths
• System environment variables
• Network resources or external APIs

What this skill does NOT do:

• - Send data to external services
• Execute arbitrary code
• Modify files outside its workspace

Dependency note:
This skill reads observation data from failure-memory skill's workspace (.learnings/).
Install leegitw/failure-memory for full constraint generation functionality.
Without failure-memory, constraint generation will have no observation data to process.

Audit logging:
Override actions are logged to output/hooks/blocked.log for audit purposes.
Logs are stored locally in the workspace only.

Acceptance Criteria

• - [ ] /ce check validates action against active constraints
• [ ] /ce check blocks when constraint violated, shows reason
• [ ] /ce generate creates constraint from eligible observation
• [ ] /ce generate applies positive reframing
• [ ] /ce status shows circuit breaker state and active constraints
• [ ] /ce override creates temporary bypass with audit log
• [ ] /ce lifecycle transitions constraint through states
• [ ] /ce version increments constraint version preserving history
• [ ] Circuit breaker trips at severity-appropriate thresholds
• [ ] Workspace files follow documented structure

---

Consolidated from 7 skills as part of agentic skills consolidation (2026-02-15).